New authentication system APPEL - Management of user rights for your organisation

Transcription

1 Sent by only EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR HUMANITARIAN AID - ECHO Directorate В Support to operations Réf n ^ll-jös.. Unit B/2 Finance Management, Legal and procedural affairs Brussels ECHO/B2/LB-AS TO ALL ECHO PARTNERS Subject: New authentication system APPEL - Management of user rights for your organisation Dear Partner, APPEL is the application for electronic exchange ofinformation between DG ECHO and its partners (NGOs, International Organizations, and United Nations Organizations). It is used by DG ECHO partners to update data relating to their organisations and to manage projects through the е-single Form. APPEL is also used by NGOs willing to become a DG ECHO partner to submit an application for partnership. Since July 2009, a new authentication system is available for connecting to APPEL. This system based on the "European Commission Authentication System" (ECAS) aims at facilitating the communication between the European Commission and external organisations. It allows these organisations to access and manage safely different protected databases of the European Commission with a unique username and password per person. From now on, in order to be able to connect to APPEL and use it safely, each partner will have to authorise its own users to access data related to its organisation. As each partner's user will be uniquely identified by its own ECAS account, the roles attributed to each ECAS username will define the possible accesses for that user in APPEL. The old authentication system used until now by DG ECHO Partners will be deactivated in the coming months after a transitional period. Therefore, DG ECHO invites all its partners to organise the registration of all concerned members in ECAS, if this has not already been done for AIDCO- or other applications, as well as the authorisation of accesses inside the organisation. If the users inside your organisation never had an ECAS username and password, the first things to do will be that every user registers him/her selves in ECAS by accessing the APPEL homepage ( and following the instructions. An on-line help is available throughout the registration process. Once the registration in ECAS confirmed, the authorisation by that ECAS username to access information in the APPEL database related to the Organisation has still to be done. Commission européenne, B-1049 Bruxelles / Europese Commissie, B-1049 Brussel - Belgium. Telephone: (32-2) Office: AN88 2/55. Direct line: (32-2)

2 In APPEL, five different roles have been designed to allow the DG ECHO Partners to manage the authorisation linked to a user connecting with his ECAS username and password. These roles are: reader, administrative, encoder, sender and user rights administrator (see details in the Charter attached). There is no limit to the number of access for an organisation in APPEL and one person can have several roles. However, since access to APPEL might have legal impact, it is important to properly define and manage the user's rights. DG ECHO is in charge of the management of the User Right Administrators of all partners, based on validated documents provided by the partner (see declaration of User Right Administrators and charters signed by these persons). Each organisation is responsible for the management of its other staff user rights: creation, modification and deletion. This can only be done by the User Rights Administrators. Considering the size of the organisation, its operational mechanisms and the need for continuity of operations, several User Rights Administrators can be nominated. In order to activate the access of the User Rights Administrator, each organisation will have to provide DG ECHO with the following documents: a declaration related to the User Rights Administrator(s) signed by the legal representative of the organisation and User Right Administrators to be created, authorising DG ECHO to create or delete usernames with this role; a Charter establishing the rights and obligations of the APPEL Users signed by each of the User Rights Administrators to be created. The User Rights Administrator will be informed through an on the receipt of his/her charter and on the activation of his/her user rights. In conclusion, DG ECHO is inviting you to create an ECAS account per user for the concerned users inside the organisation (if necessary) and to activate their user rights as soon as possible and at the latest before 30 April 2010 by sending back the declaration related to the User Right Administrators and their signed charters by to [email protected], where you can also address your needs for additional information. Yours sincerely, Herman MOSSELMANS Head of Unit Enclosures: - APPEL Users Charter - Declaration related to the User Rights Administrators - User Guide (available at fr.htm )

3 Charter establishing the principles governing the access to APPEL APPEL is the application for electronic exchange of information between DG ECHO and its partners (NGOs, International Organizations, and United Nations Organizations). It is used by DG ECHO partners to update data relating to their organisations and to manage projects submitted through the e- Single Form. APPEL is also used by organisations willing to become a DG ECHO partners to submit an application for partnership. Connection to APPEL is possible using the ECAS user account. ECAS, the "European Commission Authentication System" is a system aiming at facilitating the communication between the European Commission and external organisations. It allows these organisations to access and manage safely different protected databases of the European Commission with a unique username and password per person. It is the responsibility of each organisation using APPEL to manage its own user rights: creation, modification and deletion. DG ECHO will grant only access to the user Right Administrators, who will manage all APPEL users inside the organisation. This responsibility is governed by the principles mentioned below: There are five types of permissions/rights: The reader role only allows the user to consult information in APPEL. The user cannot encode, modify or send data to ECHO. The Administrative role is needed to be authorized to modify the organisation's administrative data. With the administrative role, you cannot manage E-requests. The Encoder role grants the right to encode or modify Е-requests in APPEL in addition to the consultation of all available information. The Sender role makes it possible to send Е-requests to ECHO. It also includes the same capability as the Encoder role. The sender access is the most important one, the sender validates the accuracy of the data and engages the responsibility of the organisation. It is recommended to have 2 senders in case of absence of one of them. The User Rights Administrator role allows the user to manage the APPEL user rights of the other members of the organisation. User Right Administrators are playing a key role as they are the persons designated by the organisation to grant the access to the staff members and to co-ordinate with DG ECHO the implementation of user rights related to APPEL. There is no limit in the number of users having these rights. As many users as necessary can be created depending on the internal needs. It is advisable to keep the number of users within reasonable limits, on the one hand, to assure continuity of operations and, on the other hand, to guarantee data quality and coherence. One user can have several rights. The User Rights Administrator will have two ways for managing user rights. Either he/she waits until a user requests some rights for using APPEL, or he/she gives proactively user rights to staff members of the organisation. The access granted should be in accordance with the organisation internal rules. The assignment of rights should be documented and retained for purpose of monitoring. The User Rights administrator should update regularly the list of users. When a person leaves the organisation, the user's profile has to be deleted. All users who are granted access to the system should use their access only for the purposes intended and should only act according to the roles and responsibilities and access rights given to them and according to their work assignments. The organisation should establish a procedure to ensure that the access rights granted to his/her staff are still entirely in line with the tasks delegated to them.

4 Users are required to conform to the rules and responsibilities set out in the organisation's internal rules or contractual provisions. Users will act according to the instructions given to them and they shall report all problems within the system which they may discover during their work to a User Right Administrator, who will coordinate with DG ECHO on further follow-up. Users should not reveal their password under any circumstances. The only exception allowed is in case remote assistance is required from specialised personnel not disposing of screen capture software and not located in the same building. After such assistance, the user shall immediately change his password. Where passwords are made known to other persons, the password owner is responsible for the actions undertaken with their username / password. The Commission declines all responsibility for the accuracy of information supplied in APPEL by DG ECHO Partners. The data collected is only accessible outside the Commission by people authorised by the User Rights Administrator of the concerned organisation. Inside the Commission, the data can be accessed by designated Commission representatives using a UserlD and a password. Protection of personnel data is regulated by Regulation (EC) 45/2001 of the European Parliament and the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the European Union institutions and bodies and on the free movement of such data. I (name, function 1 ) hereby declare that I accept the conditions set out in this Charter and that I received a copy of it. Signed on, at Name: /username: Signature: This charter has mandatory to be signed by the User Rights administrators and a copy sent to DG ECHO ( [email protected] ). It is good practice that such charter is also signed by all concerned users who are granted access to APPEL inside the organisation. It is the organisation's responsibility to assure that their users are aware of their obligations and responsibilities and these documents have not to be sent to ECHO for these categories of users.

5 DÉCLARATION RELATED TO THE USER RIGHTS ADMINISTRATOR(S) I, the undersigned,, [name], [title], declare that the person(s) mentioned below has/have been nominated as the APPEL User Rights administrator(s) for [Organisation's name], registered at [address] CreateD Delete Ū 3 : [name] - [function] 4 [username/ address] 5 [signature for acceptance in case of creation] CreateD Delete D 3 : CreateD Delete D 3 : [name] - [function] [username/ address] [signaturefor acceptance in case of creation] [name] - [function] [username/ address] [signature for acceptance in case of creation] My organisation accepts all responsibilities for the accesses done by user rights attributed by one of the above created user right administrators In case the accesses of User Right Administrators have to be changed, I will notify DG ECHO immediately of the needed changes. Signed on, at Name 2 : username: Signature: 2 Legal representative of the Partner's organisation. 3 Please tick mandatory one of both options With his/her signature the person agrees to take the role as user right administrator for that organisation 5 Please provide the address that will be used to connect to APPEL/ECAS